I've never worked in an environment where I really had to care (well, check that: at Fly.io we had to switch to tunneling WireGuard over WebSockets because UDP turns out not to be reliably deliverable) but I imagine the most common reason are company border security devices --- those devices also sometimes get deployed on places like public library wi-fi, too.